Andriller is a program for Windows with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices. It has other features, such as powerful Lockscreen cracking for Pattern, PIN code, or Password; custom decoders for Apps data from Android (and some Apple iOS) databases for decoding communications. Decoders produce reports in a HTML format. Basic Setup Andriller comes as a lightweight setup installable. It requires no dependable to be installed. All it needs is a web browser for viewing results. Simple. Features Automated data extraction and decoding Data extraction with root permissions: root ADB daemon, CWM recovery mode, or SU binary (Superuser/SuperSU) Data extraction by Android Backup (Android versions 4.x). Selection of individual database decoders for Android and Apple Lockscreen cracking for Pattern, PIN, Password.

Extraction of data while the device is in RECOVERY MODE (ClockWorkMod, etc.) with root privilleges and /system and /data partitions mounted.

Configutation now has Offline Mode, which skipps the version check on startup.

What is new in version 2.3.2:

Version 2.3.2:

Lockscreen Gesture pattern decoding is now performed locally without the need to submit a hash value online. Import the 'gesture.key' file directly or input the hash value. Depending on CPU, the gesture hash is usually decoded within a few seconds.

Lockscreen Brute force cracker now has procentage and time remaining for completion; also includes minor improvements.

Configurations menu added under File. Minor miscelaneous options can be defined by the end user, these include: defining the default Output directory; setting the password cracking update rate (after how many password tries the update should be visualised).

Configurations; last used path is now remembered from Decoders and other locations.

Licensing issues; if upgrading a newly generated unique id will be issued.